From 13c1f5c1ba47dc56effc004584cd2010de044161 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 27 Jul 2026 19:31:12 +1000 Subject: [PATCH] gitea: consume the KV admin seed only at engine-config creation Why: after the engine is first configured, rotate-root changes the live admin password so it diverges from the KV seed. Re-reading the (possibly stale) seed on a later apply must not push it back and clobber the rotated password. Ben asked that the seed be used only when initially creating the config. Change: - Add lifecycle ignore_changes on admin_username/admin_password to the gitea_secret_backend resource, making the module create-only for the seeded credential. Noted inline that the rancher/litellm seed modules lack this. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- .../modules/gitea_secret_backend/main.tf | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/modules/vault_cluster/modules/gitea_secret_backend/main.tf b/modules/vault_cluster/modules/gitea_secret_backend/main.tf index 3d37191..997e128 100644 --- a/modules/vault_cluster/modules/gitea_secret_backend/main.tf +++ b/modules/vault_cluster/modules/gitea_secret_backend/main.tf @@ -20,4 +20,15 @@ resource "gitea_secret_backend" "this" { ca_cert = var.ca_cert tls_skip_verify = var.tls_skip_verify request_timeout_seconds = var.request_timeout_seconds + + lifecycle { + # The KV seed is a bootstrap credential: it is consumed only when the engine + # config is first created. After creation the live admin password is rotated + # in place (vault write -f gitea/config/rotate-root) and diverges from the + # seed, so re-reading the (possibly stale) KV value must never push it back. + # Ignoring the credential attributes makes this module create-only for them. + # (The sibling rancher/litellm seed modules do not yet do this and would + # re-push their seed on a subsequent apply.) + ignore_changes = [admin_username, admin_password] + } }